Sign inSign up

readytalk/vault-to-envs

By readytalk

•Updated about 7 years ago

A Docker container for extracting Vault secrets into environment variables

Image
0

8.0K

readytalk/vault-to-envs repository overview

⁠Extracting Vault Secrets into Environment Variables

A Docker container for extracting Vault secrets into environment variables for use in deploys or development.

⁠Prerequisites

  • A Vault instance
  • A Valid Authentication Token

⁠Basic Usage

docker run \
  --rm \
  -e VAULT_ADDR="https://vault.my-domain.com:8200" \
  -e VAULT_TOKEN="<token>" \
  -e SECRET_CONFIG="<configuration (see below)>" \
  readytalk/vault-to-envs:latest

Will output, as an example:

export DB_PASSWORD=abc123
export AWS_ACCESS_KEY_ID=abc123
export AWS_SECRET_KEY=abc123

⁠Docker Environment Variables

To customize some properties of the container, the following environment variables can be passed via the -e parameter (one for each variable). Value of this parameter has the format <VARIABLE_NAME>=<VALUE>.

VariableDescriptionDefault/Required
VAULT_ADDRThe full address of the instance of vault to connect to. For example https://vault.my-domain.com:8200required
VAULT_TOKENVault token to use for authentication.required
SECRET_CONFIGDefinition of which secrets/keys to extract and what environment variables to set them to. See below for more details.required
DEBUGSet to true to output verbose details during executionfalse

⁠Configuration

This container is configured with the SECRET_CONFIG environment variable which is a JSON formatted set of settings that determine which secrets get extracted from Vault.

⁠Examples
⁠Simple Secrets

Take an example where we have two secrets. The first contains 3 keys with database information. The second contains some type of token.

secret_config.json

[
  {
    "vault_path": "secret/app/database",
    "set": {
      "DB_HOST": "dbHost",
      "DB_USER": "dbUser",
      "DB_PASSWORD": "dbPass"
    }
  },
  {
    "vault_path": "secret/app/token",
    "set":  {
      "APP_TOKEN": "token"
    }
  }
]

Command

docker run \
  --rm \
  -e VAULT_ADDR="https://vault.my-domain.com:8200" \
  -e VAULT_TOKEN="<token>" \
  -e SECRET_CONFIG="$(cat secret_config.json)" \
  readytalk/vault-to-envs:latest

Output

export DB_HOST='xxxxxxxxxxxxxx'
export DB_USER='xxxxxx'
export DB_PASSWORD='xxxxxxxxxxxxxxx'
export APP_TOKEN='xxxxxxxxxxxxxxxxx'
⁠Dynamic Secrets

This example uses Vault's AWS Secret Backend⁠ to create an access/secret key for an AWS account. The only difference in this example is that we can set a TTL that will try to be met, if allowed. If no TTL is set, the lease duration will be whatever default is configured within Vault.

secret_config.json

[
  {
    "vault_path": "aws/creds/my-role",
    "ttl": 600,
    "set": {
      "AWS_ACCESS_KEY_ID": "access_key",
      "AWS_SECRET_ACCESS_KEY": "secret_key"
    }
  }
]

Command

docker run \
  --rm \
  -e VAULT_ADDR="https://vault.my-domain.com:8200" \
  -e VAULT_TOKEN="<token>" \
  -e SECRET_CONFIG="$(cat secret_config.json)" \
  readytalk/vault-to-envs:latest

Output

export AWS_SECRET_ACCESS_KEY='xxxxxxxxxxxxxxxxxxxxxxxxx'
export AWS_ACCESS_KEY_ID='xxxxxxxxxxxxxxxxxx'

⁠Sourcing the Env Vars

One way to source the output of the container is to simply eval the docker run output. If a successful run occurs the stdout will be evaluated and the environment variables set.

eval $(docker run \
  --rm \
  -e VAULT_ADDR="https://vault.my-domain.com:8200" \
  -e VAULT_TOKEN="<token>" \
  -e SECRET_CONFIG="<configuration (see below)>" \
  readytalk/vault-to-envs)"

Tag summary

Content type

Image

Digest

Size

5.7 MB

Last updated

over 8 years ago

docker pull readytalk/vault-to-envs